CVE-2026-53615: util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
Integer Overflow or Wraparound in libblkid/src/partitions/dos.c
Other sources
util-linux is a random collection of Linux utilities. Before util-linux 2.41.4, parsedosextended() in libblkid/src/partitions/dos.c computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap curstart + start to sector zero and cause libblkid to report a false partition overlapping the MBR. This directly compromises the integrity of the reported partition metadata; disk modification or availability loss requires a separate downstream consumer to act on that metadata. This issue is fixed in 2.41.4.
— MITRE
util-linux libblkid DOS extended-partition overflow produces invalid partition metadata
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/util-linuxto a version that resolves this vulnerability.Fixed in 2.41.5-0+deb13u1Fixed in 2.42.2-4 - Upgrade
Upgrade
util-linuxto a version that resolves this vulnerability.Fixed in 2.41.4